skills.rest
kmshihab7878
kmshihab7878COMMUNITY
Explore all skills by this author →
GitHub

container-security

Harden Docker images and Kubernetes deployments against privilege escalation and insecure configurations.

6|1|Updated Apr 7, 2026
Search Tags:#kubernetes#docker#hardening#network-policy#trivy#gatekeeper#container-security
One-click install
npx skills add https://github.com/kmshihab7878/claude-code-setup --skill container-security-kmshihab7878
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container-security
Source: https://github.com/kmshihab7878/claude-code-setup/tree/main/skills/container-security
Command: npx skills add https://github.com/kmshihab7878/claude-code-setup --skill container-security-kmshihab7878

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reduce the attack surface of containerized applications by eliminating unsafe image practices, preventing containers from running as root, and enforcing cluster-level controls to stop privilege escalation and lateral movement.

Core Features & Use Cases

  • Docker image hardening: guidance on multi-stage builds, minimal base images, removing secrets from layers, and running as non-root.
  • Kubernetes security contexts: examples to enforce runAsNonRoot, drop capabilities, read-only root filesystems, fsGroup, and seccomp profiles.
  • Network policy & admission controls: design of pod-level NetworkPolicy rules and OPA/Gatekeeper policy suggestions to restrict ingress/egress and enforce organizational policies.
  • Scanning and validation: recommended use of Trivy for image, manifest, and cluster scanning to detect HIGH/CRITICAL issues.
  • Use Case: Harden a microservice image in CI, ensure the deployment manifest enforces non-root execution and seccomp, and apply NetworkPolicies limiting traffic to only ingress controllers and database pods.

Quick Start

Scan the jarvis-fresh image and the k8s manifests for HIGH/CRITICAL findings, ensure the container runs as a non-root user with dropped capabilities and a read-only root filesystem, and add a NetworkPolicy that only allows ingress from the ingress-nginx pods and egress to the postgres pod and DNS.

Frequently Asked Questions about container-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden Docker images to prevent containers from running as root?▼

To harden Docker images, use multi-stage builds with minimal base images, remove secrets from layers, define a non-root user, and include a HEALTHCHECK. This prevents privilege escalation and reduces the container attack surface.

What Kubernetes securityContext settings are needed to enforce non-root execution?▼

Kubernetes securityContext must enforce runAsNonRoot, drop Linux capabilities, set read-only root filesystems, configure fsGroup, and apply RuntimeDefault seccomp profiles to prevent privilege escalation in pod deployments.

How do I restrict ingress and egress traffic using Kubernetes NetworkPolicy?▼

Restrict ingress and egress traffic by designing pod-level NetworkPolicy rules that explicitly limit communication, such as allowing ingress only from ingress controllers and egress solely to database pods and DNS.

Does this work with Trivy for scanning HIGH and CRITICAL vulnerabilities?▼

Yes, Trivy is recommended for image, manifest, and cluster scanning to detect HIGH and CRITICAL vulnerabilities. It validates that your hardened Docker images and Kubernetes manifests are free from severe issues.

Can I use OPA Gatekeeper to enforce admission control on Kubernetes manifests?▼

Yes, OPA Gatekeeper provides policy suggestions to enforce organizational policies at admission control. It restricts ingress and egress while ensuring manifests comply with your required security contexts.

What is the best way to secure a microservice image in a CI pipeline?▼

The best way to secure a microservice image in CI is to build minimal images, enforce non-root execution, scan with Trivy for HIGH/CRITICAL findings, and validate manifest security contexts and NetworkPolicies.

Related Skills

Explore More Software Engineering Skills→
JeffallanJeffallan
10.9k

kubernetes-specialist

Automate Kubernetes deployments, configuration, and hardening for production workloads.

Community
Advanced
hardw00thardw00t
90

container-security

Automates container security assessments across Docker images, Kubernetes clusters, and runtimes using Trivy, Grype, Kubescape, kube-bench, and Falco.

Community
Advanced
NickCrewNickCrew
29

kubernetes-security-policies

Enforce Kubernetes security policies across clusters and namespaces.

Community
Advanced
alexmaruccialexmarucci

security-posture-management

Manage cloud security posture via Datadog CSPM, Vulnerability Management, and Security Findings APIs.

Community
Advanced